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Period for Reply 

A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) FROM 
THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 .136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If the period for reply specified above is less than thirty (30) days, a reply wWhin the statutory minimum of thirty (30) days will be considered timely. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 1 33). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1 .704(b). 

Status 

1 )^ Responsive to communication(s) filed on 14 November 2004 . 
2a)n This action is FINAL. 2b)^ This action is non-final. 

3) n Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1 935 CD. 1 1 , 453 O.G. 213. 

Disposition of Claims 

4) ^ Claim(s) 1-27 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration, 

5) n Claim(s) is/are allowed. 

6) ^ Claim(s) ^27 is/are rejected. 
?)□ Claim(s) is/are objected to. 

8) n Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) n The specification is objected to by the Examiner. 

10)^ The drawing(s) filed on 12 November 2004 is/are: a)^ accepted or b)^ objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1.85(a). 

Replacement drawing sheet(s) including the correction Is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 
11 )□ The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 

Priority under 35 U.S.C. § 119 

12)0 Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 119(a)-(d) or (f). 
a)n All b)n Some * c)^ None of: 

1 .□ Certified copies of the priority documents have been received. 

2. n Certified copies of the priority documents have been received in Application No. . 

3. D Copies of the certified copies of the priority documents have been received in this National Stage 

application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 
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DETAILED ACTION 
Claim Rejections - 35 USC § 102 

1 . The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the 
basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(b) the invention was patented or described in a printed publication in this or a foreign country or in public use or on 
sale in this country, more than one year prior to the date of application for patent in the United States. 

2. Claims 1-5, 7-15, 17-24 and 26-27 are rejected under 35 U.S.C. 102(b) as being 
anticipated by Esbensen (US 5,796,942). 

Regarding claim 1, Esbensen teaches a Method and Apparatus For Automated Network- ^ 
Wide Surveillance and Security Breach Intervention. 

A network bridge (a network surveillance system 1, Fig. 3) having a malware scanner 
(having a scanner process 30, Fig. 1 for filtering out unwanted data such as viruses, col. 2, lines 
24-32 and lines 42-47). 

Regarding claims 2, 12 and 21, Esbensen teaches a handler process 10, Fig. 1, {a data 
packet analyser) for filtering and processing {identify) the data packets received by the network 
surveillance system 1, Fig. 3 and places the data {at least a portion) for scanning by the scanner 
process 30, Fig. 1 {malware scanner), col. 3, lines 53-67 and col. 4, lines 1-5. 

Regarding claims 3, 13 and 22, Esbensen teaches a handler process 10, Fig. 1 {said data 
packet analyser) for filtering or processing {identifies) the TCP/IP data packets, in which it 
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identifies the predetermined network layer protocol (TCP) and passed the packets to the scanner 
process 30, Fig. 1 for scanning, col. 3, lines 53-67, col. 4, lines 1-5 and col. 5, lines 1-4. 

Regarding claims 4, 14 and 23, Esbensen teaches the handler process 10, Fig. 1, for 
filtering TCP/IP data and passed the filtered data to the scanner process 30, Fig. 1 for further 
filtering viruses, col. 5, lines 1-4. 

Regarding claims 5, 15 and 24, Esbensen teaches the handler process 10, Fig. 14 (said 
data packet analyser), for filtering TCP/IP data and passed the filtered data to the scanner 
process 30, Fig. 1 for further filtering viruses, in which it identifies data packets having a 
predetermined appUcation layer protocol, col. 3, lines 61-64. 

Regarding claim 7, Esbensen teaches placing the data packets into a file 15a to be 
scanned (concatenate portions of a data file fi-om a plurality of data packets to form a data file 
to be scanned), col. 3, lines 60-65. 

Regarding claims 8, 18 and 26, Esbensen teaches a session window process 34 within 
the scanner process 30 (malware scanner), Fig. 1 for scanning computer viruses, banned 
computer programs, col. 2, lines 19-32 and col. 4, lines 19-25. 

Regarding claim 9, the network surveillance system 1, Fig. 3 of Esbensen is capable of 
forwarding to its intended destination after all filtering and processing stages, col. 5, lines 1-3. 
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Regarding claims 10, 19 and 27, Esbensen teaches that the scanner process 30 (malware 
scanner) can be implemented with a software based, Fig. 5 and a hardware based scanner, Fig. 
6, coL 3, Hnes 14-16, col. 7, lines 63-57 and col. 8, lines 1-4. 

Regarding claim 11, this claim has similar limitations of claims 2 and 9. Therefore, it is 
rejected under Esbensen for the same reasons set forth in the rejections of claims 2 and 9. 

Regarding claim 17, this claim has similar limitations of claims 7 and 9. Therefore, it is 
rejected under Esbensen for the same reasons set forth in the rejections of claims 7 and 9. 

Regarding claim 20, this claim has similar limitations of claims 11,12 and 17. 
Therefore, it is rejected under Esbensen for the same reasons set forth in the rejections of claims 
11, 12 and 17. 

Claim Rejections - 35 USC §103 
3. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 
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4. This application currently names joint inventors. In considering patentability of the 
claims under 35 U.S.C. 103(a), the examiner presumes that the subject matter of the various 
claims was commonly owned at the time any inventions covered therein were made absent any 
evidence to the contrary. Applicant is advised of the obligation under 37 CFR 1.56 to point out 
the inventor and invention dates of each claim that was not commonly owned at the time a later 
invention was made in order for the examiner to consider the apphcabihty of 35 U.S.C. 103(c) 
and potential 35 U.S.C. 102(e), (f) or (g) prior art under 35 U.S.C. 103(a). 

5. Claims 6, 16 and 25 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Esbensen in view of Donaldson (US 6,321,267). 

Regarding claims 6, 16 and 25, Esbensen teaches all claimed limitations, except the 
predetermined application layer protocol is of SMTP. 

Donaldson teaches an active filtering SMTP proxy 1 104, Fig. 9, for filtering out junk 
emails (col. 11, lines 37-43). 

Esbensen and Donalson are analogous art because they are fi^om a similar problem of 
filtering data packets. 

At the time the invention, it would have been obvious to a person of ordinary skill in the 
art to combine the packets filter of Donalson and Esbensen. 

The suggestion/motivation for doing so would have been to protect organization's 
internal network from being hacked or to stop the virus attacking the internal systems. 
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Therefore, it would have been obvious to combine Donalson and Esbensen to obtain the 
invention as specified in claim 6. 

Conclusion 

6. The prior art made of record and not relied upon is considered pertinent to applicant's 
disclosure. Antur et al (US 6,212,558); Kirby et al (US 5,828,846); Shannon (US 6,233,618); 
Shwed (US 5,606,668); Pickett et al (US 6,356,554); Cooper et al (US 2004/0039942); Ji et al 
(US 5,623,600) are cited to show a system and method of Malware Scanning Using a Network 
Bridge, which is considered pertinent to the claimed invention. 

7. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Lee Khuong whose telephone number is 571-272-3157. The 
examiner can normally be reached on 9AM - 5PM. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Huy Vu can be reached on 571-272-3 155. The fax phone number for the 
organization where this application or proceeding is assigned is 703-872-9306. 

8. Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). 



Application/Control Number: 09/912,305 
Art Unit: 2665 




LeeT. Khuong DUCHO 
Examiner PRIMARY EXAMINER 

Art Unit 2665 



